IP with multiple failed Microsoft Entra ID logins successfully logs in to Palo Alto VPN

This query creates a list of IP addresses with the number of failed login attempts to Entra ID above a set threshold ( default of 5 ). It then looks for any successful Palo Alto VPN logins from any of these IPs within the same timeframe.